Privacy Policy

1. What is collected

This policy covers the website mostwatched.app and the iOS app “mostwatched in Korea” (뭐 봐?). There are no accounts on this site: no sign-up and no log-in. Seeing the rankings and reading or writing on the board ask for no e-mail, phone number or real name. The app’s advertising and its advertising identifier are set out in section 2. No analytics SDK is bundled. For the rankings, only these two things are handled automatically; what the board handles is set out in section 5, and answers for the new-words ranking in section 6.

• Thumbs up and down, “went to watch” taps, and how many people are looking at the same time: when you press a button, when you tap a row and leave for the platform, and while the page or the app is open, only the number is counted. To count one person once a day, the server turns the IP address and the type of client into a short irreversible code and keeps it for at most 24 hours; the address itself is never stored. Which items you voted on stays on the device you voted from (in the browser’s localStorage on the website, in the app’s own settings on iOS) and is not sent anywhere.
• Rate limiting: the server counts requests from an IP address in one-minute steps and drops the record straight afterwards.

2. Cookies and third-party advertising

The website — The food comparison guides may show Google AdSense ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and to other websites. They may also use web beacons and the IP address to show ads. How Google uses this information is set out at How Google uses information from sites or apps that use its services. You can turn off personalised advertising at Google Ads Settings. You can turn off other vendors’ cookies for personalised advertising at aboutads.info/choices. This site sets no cookie of its own.

The iOS app — The iOS app “mostwatched in Korea” may show Google AdMob ads. The Google Mobile Ads SDK in the app reports to Google which ads were shown and tapped. The SDK estimates a rough region from the IP address. The app does not ask for location permission. The advertising identifier (IDFA) is used only when you consent. When ads are on, two prompts ask for consent: first the Google consent prompt (UMP), then the iOS App Tracking Transparency prompt (ATT). The app works the same if you decline. You can turn off ad personalisation in iOS Settings under “Privacy & Security › Tracking” and at Google Ads Settings. The app itself sends no identifier to this site’s server.

3. Links out, and third parties

Tapping a row takes you to the platform it came from — YouTube, Netflix, Wavve, Naver Series, Naver Webtoon, Chzzk or Instagram. The thumbnails, posters and photos in the lists load straight from those platforms' servers and from Wikimedia Commons, and your browser sends them its IP address when it does. What happens to your data there is governed by that platform’s own privacy policy. Nothing counted here is sold, and nothing is passed to anyone else. The only third party involved is Google, which serves the advertising on the website and in the app and handles what it collects under its own privacy policy and the Google advertising terms; we hand it nothing of our own. The companies that run the board for us as processors are listed in section 5.

The YouTube lists use YouTube API Services. We read public video data only and no YouTube account data. We ask no one to sign in with Google. Google handles its data under the Google Privacy Policy. The YouTube Terms of Service also apply.

4. Keeping, deleting, contact

The daily code is deleted automatically within 24 hours, and the rate-limiting record within a minute. The rankings need no account, so nothing else that could identify a person is kept for them; board records are kept and deleted as section 5 says. The record of your own votes disappears when you clear this site’s data in your browser or delete the app. For a question, to withdraw consent, or to ask for anything held about you to be deleted, write to ilwoongpark@gmail.com.

5. The board

Why — To show posts and comments, to let an author edit or delete their own post or comment with its password, to handle reports, to stop spam and password guessing, and to meet legal duties. Nothing else.

What

• Writing a post or a comment: the text, the nickname you typed (empty: “Anonymous”), its password (stored only as a one-way scrypt value, never as typed), and a short one-way code made from your IP address and browser type that changes every day (to count posts per day).
• Every post, comment, edit, deletion and report: the IP address and time; the number of wrong passwords (per IP address). The same record enforces a pause between two writes from one IP address (30 seconds for posts, 5 seconds for comments).
• A report: the daily code above, so that one person reports a post once.

How long, and how it is deleted

• Posts and comments (with the nickname and the password value): until the author deletes them with the password or the operator removes them.
• IP address records: kept 90 days, then deleted (Korean Protection of Communications Secrets Act, Enforcement Decree art. 41(2): internet log records, 3 months).
• Reports: deleted after 90 days.
• The operator’s actions on posts: kept more than one year (400 days), then deleted (Standards for Personal Information Security Measures, art. 8).
• Accounts made before 29 September 2026 (user ID, password value, nickname, recovery code value): no longer used, and nothing new is collected. The records remain in the database and are deleted at once on request.
• Deletion removes the database rows and cannot be undone. Expired records are deleted automatically once an hour.

Processors and transfer abroad — The site and the board run on the servers of the three companies below. All three are US companies. The Supabase database and the Vercel functions are in Seoul, Korea. Nothing new has been sent to Upstash since 27 September 2026. Because these companies can access the data to run their service, we disclose this as a transfer abroad (Personal Information Protection Act art. 28-8(1)(3): processing and storage needed to perform the contract).

• Supabase, Inc. — contact: the company’s privacy policy page, supabase.com/privacy
  • Country: US company, database in the Seoul region
  • Items: everything under “What”, the daily code and the counters of section 1, and the old board’s posts (before 2026-09-25)
  • Purpose: database
  • When and how: at each post, comment, edit, deletion, report and button press, over HTTPS
  • Kept: board records as under “How long”; the daily code and counters up to 24 hours; old posts until the operator removes them
• Vercel Inc. — contact: the company’s privacy policy page, vercel.com/legal/privacy-notice
  • Country: US company, functions run in Seoul (icn1)
  • Items: the request’s contents, IP address
  • Purpose: website and server functions
  • When and how: at each visit, over HTTPS
  • Kept: while the request runs (Vercel’s own logs follow Vercel’s policy)
• Upstash, Inc. — contact: the company’s privacy policy page, upstash.com/trust/privacy.pdf
  • Country: US company, servers in the region set by the company
  • Items: a copy of the old board’s posts (before 2026-09-25)
  • Purpose: old posts and request counting until 27 September 2026; not used now
  • When and how: over HTTPS until 27 September 2026; nothing is sent after that
  • Kept: the remaining copy until the operator deletes the store

If you do not want board records transferred this way, do not post or comment (if you signed up before 29 September 2026, ask for the account data to be deleted). You can still read the rankings and the board.

Security — Post and comment passwords are stored only as one-way values. All traffic is encrypted (HTTPS). The database opens only with a key held by the server; the public key can read no table (two separate locks). More than 30 wrong post passwords an hour from one IP address block editing and deleting from it for that hour. Every operator action is logged.

Cookies — The board sets no cookie (before 29 September 2026 one cookie, __Host-mw, kept members logged in; it is no longer used). Advertising cookies follow section 2, “Cookies and third-party advertising”.

Your rights — You can ask to see, correct, delete, or stop the processing of your data. You can edit or delete your own post or comment at once with its password. If you forgot the password, or want an earlier account’s data deleted, e-mail ilwoongpark@gmail.com with where the post is or the user ID. We answer within 10 days.

6. Answers for the new-words ranking

• The ranking itself is made from how many YouTube video titles hold each word. It uses no personal information.
• On the new-words ranking page, the age band you choose is saved only in the browser of your device (localStorage).
• The age band is one of teens (14 and over), 20s, 30s, or 40 and over.
• When you answer “Do you use this word?”, three values go to the server: the word, the age band, and the answer.
• The server saves only daily totals per age band and answer. Example: “11 October, 20s, word A, ‘I use it’ 12 times”.
• There is no record per person. No name, account, address or device identifier is saved with an answer.
• One person can answer a word once a day. For this, the server makes a value that cannot be reversed from the address, the browser information and the date. This value stays in server memory and is removed when the day changes.
• Daily totals are kept for 90 days and then deleted.
• The age band and the list of answered words on your device are removed when you clear the browser’s site data.
• These totals are not given to any other company.

7. Privacy officer and remedies

Who runs it, and the privacy officer — Benchlog, a sole proprietorship in Korea, runs mostwatched (뭐 봐?). The privacy officer is the owner, Il Woong Park (ilwoongpark@gmail.com).

Benchlog, sole proprietorship · Owner Il Woong Park · Business registration no. 2560803339 · ilwoongpark@gmail.com

Remedies (Korea) — For advice or dispute resolution about a privacy infringement, you can apply to:

• Personal Information Dispute Mediation Committee: 1833-6972 (in Korea), www.kopico.go.kr
• Personal Information Infringement Report Center: 118 (in Korea), privacy.kisa.or.kr
• Korean National Police Agency cyber bureau: 182 (in Korea), ecrm.police.go.kr

8. Changes

This policy applies from 30 October 2026. Website ad placements now use food comparison guides. Section 3 now names YouTube API Services, the Google Privacy Policy and the YouTube Terms of Service. The policy of 15 October 2026 stated the operator as Benchlog, a sole proprietorship, and the privacy officer as its owner, Il Woong Park. The policy of 12 October 2026 added answers for the new-words ranking as section 6, and stated that the iOS consent prompts appear only when ads are on. The policy of 11 October 2026 extended the advertising-cookie notice, added board comments, and brought the list of processors in line with the present setup. The policy of 10 October 2026 added advertising in the iOS app and the use of the advertising identifier. The previous policies (in effect from 12, 11 and 10 October and 29, 26 and 23 September 2026) are sent on request.

← Home · About · Guide · Terms